CVE-2026-68098
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In the Linux kernel, ksmbd has an issue with bounding the DACL dedup walk to copied ACEs. When copying ACEs stops early due to size overflow, the number of ACEs reflects only copied ones, but set_posix_acl_entries_dacl() still uses the original count, leading to scanning beyond the copied array.
Risk Assessment
This can lead to out-of-bounds memory reads, potentially exploited for information disclosure or system destabilization.
Recommendation
Apply the patch that separates the count of copied ACEs from the original count to bound the dedup walk to actually copied ACEs.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs set_ntacl_dacl() can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, num_aces reflects only the ACEs that were actually copied into the output DACL, but set_posix_acl_entries_dacl() still receives nt_num_aces and uses it to walk the existing ACE array during dedup. That makes the dedup walk scan past the copied ACE array and inspect buffer tail that does not contain valid ACEs. Split the two meanings currently carried by the NT ACE count. Pass the number of copied NT ACEs to bound the dedup walk, and preserve the original "input DACL had NT ACEs" state separately for the Everyone/default ACL fallback. This keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL.